$282.9M lost this week $2.0B lost in 30 days $95.2B lost this year
A Fomo user lost approximately $48,000 in assets after clicking a malicious bookmark on the Fomo website, which led to the theft of login tokens and wallet credentials. The attack involved a fake human verification process that tricked the user into executing JavaScript code from a bookmarklet.
An attacker moved approximately $6.07 million from Duelbits' hot wallets across five chains in a suspected private-key compromise. The platform was taken offline for investigation and system security, later reopening on September 27, 2026, with deposits and withdrawals enabled. This incident follows a similar $4.6 million theft in February 2024.
Source: Rekt News (opens in a new tab)
A Proof of Concept (PoC) indicates an unguarded funding-growth update in Perpetual Protocol v2 (Curie) on Optimism drained a vault of approximately 3,062.21 USDC.
An exploit on MALT on the Polygon network resulted in the draining of approximately 13,440 DAI from the Capital Source treasury. The exploit involved unisolated treasury rebalance capital, allowing a negligible swap to yield a disproportionate MALT output.
Goldpesatoken (GPX) suffered a loss of approximately $114.9k due to a vulnerability in its reBalance() function. The function performed liquidity operations through a shared PositionManager without proper verification, allowing an attacker to exploit it.
DeFi project Abracadabra has proposed an orderly wind-down, citing a string of security incidents that have left its stablecoin MIM with no viable path back to parity. The protocol, which once had a $6 billion TVL, now has $22 million in outstanding MIM supply against only $900,000 in actionable backing, making MIM worth $0.04. The decision follows multiple past exploits totaling $21 million in bad debt, and recent accusations of treasury 'looting' involving significant asset movements.
Source: Protos (opens in a new tab)
An exploit PoC for AllbridgeCCTP details a phantom deposit vulnerability via unverified CCTP message attestation, leading to an estimated loss of $189.75K USDC on Base.
An attacker exploited a permissionless function in DAOstack's newOrganization to hijack an existing Reputation contract. The attacker drained the Genesis Alpha treasury, which held 4.025 ETH, by minting 20,000 REP and gaining full control.
Three DeFi projects, Payy Network, Duelbits, and Meter.io, were exploited on September 24, 2026, resulting in a total loss of over $11 million. Payy Network's bridge was drained of $1.8 million, Duelbits suffered a suspected private key compromise resulting in a $7 million loss, and Meter.io experienced a bridge attack where unbacked tokens worth $2.3 million were minted and dumped. All affected protocols have paused operations.
Source: Protos (opens in a new tab)
Duelbits experienced a suspicious outflow of approximately $4.3 million in cryptocurrency across Ethereum and BNB Chain. The stolen funds were subsequently swapped by the attacker.
Payy.link's Rollup contract was reportedly drained of approximately $1.83 million in USDC. The attacker swapped the stolen funds for ETH and distributed them across three addresses.
The NFT platform DoinGud on Polygon was exploited via a bug in its Diamond bidding contract, allowing an attacker to reuse bids and drain approximately $35,486 USDC.e on September 21, 2026.
A report by Kairos Research examines GHO and sGHO as potential backing assets for USDe, noting that while GHO's peg has held and Aave is overcollateralized, there are concerns about exit liquidity. The report highlights an asymmetry between minting and redemption capacities in Aave's stability modules, with exit capacity being significantly lower than minting capacity, particularly on the Ethereum chain.
An attacker exploited an OpenGSN meta-transaction authorization flaw on Polygon HTLC contracts, allowing them to lock and redeem stablecoins worth approximately $50,463. The attacker used leftover ERC-20 allowances to move USDC, USDT0, and USDC.e into HTLCs and then redeemed them.
GHO Stewards are proposing parameter updates to address GHO's persistent discount below par. These include raising the Horizon borrow rate, adjusting GHO Stability Module (GSM) burn fees for USDC and USDT, and increasing GSM capacity on Monad Network to support greater GHO minting volume.